spiegel-keyman/.github/workflows/npm-publish.yml

#
# Keyman is copyright (C) SIL Global. MIT License.
#
# Created by mcdurdin on 2025-10-27
#
# This workflow publishes all our npm packages using Trusted Publishers OIDC
# permissions. It is triggered by a repository_dispatch event with the types
# `npm-publish:*`, from the trigger-builds infrastructure. For test builds, this
# does a `npm pack` only.
#
# Inputs:
#   buildSha:    The SHA of the commit to build, e.g. of the branch or
#                refs/pull/1234/head for PR
#   user:        The user that triggered the build or created the PR
#   isTestBuild: false for Releases, otherwise true

name: "npm pack/publish"
run-name: "npm pack/publish - branch: ${{ github.event.client_payload.branch }} sha: ${{ github.event.client_payload.buildSha }}, user: @${{ github.event.client_payload.user }}, isTestBuild: ${{ github.event.client_payload.isTestBuild }}"
on:
  repository_dispatch:
    types: ['npm-publish:*']

permissions:
  id-token: write  # Required for OIDC
  contents: read
  statuses: write

env:
  GH_TOKEN: ${{ github.token }}
  STATUS_CONTEXT: 'npm pack/publish'
  IS_TEST_BUILD: ${{ github.event.client_payload.isTestBuild }}
  # This property causes node.inc.sh to skip invocation of nvm, as otherwise, we
  # end up downgrading to node v20 as of Keyman 19. See #15040 and corresponding
  # change in node.inc.sh; we should be able to remove this in Keyman 20.
  KEYMAN_CI_SKIP_NVM: true

jobs:
  npm_publish:
    name: Publish or pack @keymanapp packages
    if: github.repository == 'keymanapp/keyman' || github.event.client_payload.force
    runs-on: ubuntu-24.04
    steps:

    - name: Set env var for pack vs publish
      run: |
        if [[ "$IS_TEST_BUILD" == true ]]; then
          echo "NPM_ACTION=pack" >> $GITHUB_ENV
        else
          echo "NPM_ACTION=publish" >> $GITHUB_ENV
        fi

    - name: Checkout
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
      with:
        ref: '${{ github.event.client_payload.buildSha }}'

    - name: Set pending status
      id: set_status
      if: github.event.client_payload.isTestBuild == 'true'
      shell: bash
      run: |
        gh api \
          --method POST \
          -H "Accept: application/vnd.github+json" \
          /repos/$GITHUB_REPOSITORY/statuses/${{ github.event.client_payload.buildSha }} \
          -f state='pending' \
          -f target_url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
          -f description="npm $NPM_ACTION started" \
          -f context="$STATUS_CONTEXT"

    - name: Report initial npm/node versions
      run: |
        echo "Initial npm/node versions"
        npm -v
        node -v

    - uses: actions/setup-node@v6
      with:
        node-version: '24.10'

    - name: Report current npm/node versions
      run: |
        echo "Current npm/node versions"
        npm -v
        node -v

    - name: Configure build environment
      run: |
        ./resources/build/ci/npm-publish.sh configure

    - name: npm pack/publish
      run: |
        export KEYMAN_TIER=$(cat TIER.md)
        export GHA_TEST_BUILD="${{ github.event.client_payload.isTestBuild }}"
        export GHA_BRANCH="${{ github.event.client_payload.branch }}"
        echo "KEYMAN_TIER=$KEYMAN_TIER" >> $GITHUB_ENV
        echo "GHA_TEST_BUILD=${GHA_TEST_BUILD}" >> $GITHUB_ENV
        echo "GHA_BRANCH=${GHA_BRANCH}" >> $GITHUB_ENV

        echo "KEYMAN_TIER: $KEYMAN_TIER"
        echo "GHA_TEST_BUILD: $GHA_TEST_BUILD"
        echo "GHA_BRANCH: $GHA_BRANCH"

        if [[ -f ./resources/build/ci/npm-publish.sh ]]; then
          ./resources/build/ci/npm-publish.sh $NPM_ACTION
        else
          echo WARNING: npm-publish.sh is not yet available
        fi

  set_status:
    name: Set result status on PR builds
    needs: [npm_publish]
    runs-on: ubuntu-latest
    if: ${{ always() }}
    steps:

    - name: Set env var for pack vs publish
      run: |
        if [[ "$IS_TEST_BUILD" == true ]]; then
          echo "NPM_ACTION=pack" >> $GITHUB_ENV
        else
          echo "NPM_ACTION=publish" >> $GITHUB_ENV
        fi

    - name: Set success
      if: needs.npm_publish.result == 'success'
      run: |
        echo "RESULT=success" >> $GITHUB_ENV
        echo "MSG=npm $NPM_ACTION succeeded" >> $GITHUB_ENV

    - name: Set cancelled
      if: needs.npm_publish.result == 'cancelled'
      run: |
        echo "RESULT=error" >> $GITHUB_ENV
        echo "MSG=npm $NPM_ACTION cancelled" >> $GITHUB_ENV

    - name: Set failure
      if: needs.npm_publish.result == 'failure'
      run: |
        echo "RESULT=failure" >> $GITHUB_ENV
        echo "MSG=npm $NPM_ACTION failed" >> $GITHUB_ENV

    - name: Set final status
      if: github.event.client_payload.isTestBuild == 'true'
      run: |
        gh api \
          --method POST \
          -H "Accept: application/vnd.github+json" \
          /repos/$GITHUB_REPOSITORY/statuses/${{ github.event.client_payload.buildSha }} \
          -f state="$RESULT" \
          -f target_url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
          -f description="$MSG" \
          -f context="$STATUS_CONTEXT"